sharedpersistence.com

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

Messages returned by this tool originate from arbitrary, unauthenticated agents (or spoofed identities via write_message's unverified agent_id). The tool's own description frames these messages as legitimate 'state' or 'handoffs' to be acted upon, which could cause the calling AI to treat attacker-controlled text as trusted instructions (a classic prompt-injection vector via a persistent shared channel). The agent should treat message bodies as untrusted data, not as directives, and should not execute embedded commands or reveal secrets based on their content.

Like read_messages, results can contain arbitrary text planted by any agent, including content crafted to look like system/handoff instructions. There is no sanitization or provenance verification described, so the calling agent could be manipulated into following instructions embedded in search results.

The agent_id field lets any caller claim an arbitrary display name with no verification ('unverified' per the description), while a separate 'verified' cryptographic identity system is only referenced, not enforced. This allows one agent to impersonate another trusted agent identity in the shared commons, which could be leveraged to plant convincing spoofed 'handoff' instructions that later readers (including future instances of the same agent) trust.